veryfront 0.1.1237 → 0.1.1239

package/esm/cli/auth/login.d.ts

@@ -1,6 +1,17 @@
 import { type EnvironmentConfig } from "../../src/config/index.js";
 import { deleteToken, hasToken, readToken, saveToken } from "./token-store.js";
 import { type SpinnerController } from "../ui/progress.js";
+/**
+ * Describe where an API-token credential actually came from.
+ *
+ * `.env` files in the working directory are loaded into the environment, so a
+ * token can arrive under `VERYFRONT_API_TOKEN` while that variable is unset in
+ * the developer's shell. Reporting only the variable name sends them to check
+ * something they can see is empty; naming the file ends the search. Identity is
+ * directory-dependent for every command that infers a project from config, so
+ * this is worth the extra clause.
+ */
+export declare function formatEnvSourcePathForDisplay(file: string, currentCwd?: string): string;
 export type AuthMethod = "google" | "github" | "microsoft" | "token";
 export interface UserInfo {
     id: string;
@@ -14,7 +25,18 @@ export interface ApiKeyIdentity {
 export type AuthIdentity = UserInfo | ApiKeyIdentity;
 export interface CredentialValidationOptions {
     throwOnNetworkError?: boolean;
+    throwOnCredentialValidationUnavailable?: boolean;
+    /** Reuse a caller-owned cancellation or deadline across validation attempts. */
+    signal?: AbortSignal;
+    /**
+     * Abort the request after this many milliseconds. Callers that must stay
+     * responsive pass a deadline; omitting it keeps the previous unbounded
+     * behaviour for callers that are already the user's main action.
+     */
+    timeoutMs?: number;
 }
+/** Test seam: shrink the preflight deadline so a stall is observable quickly. */
+export declare function __setExistingSessionTimeoutForTests(ms?: number): void;
 export declare function createOAuthState(): string;
 export declare function createOAuthAuthorizationUrl(provider: "google" | "github" | "microsoft", callbackUrl: string, state: string, env?: EnvironmentConfig): string;
 export declare function validateToken(token: string, env?: EnvironmentConfig, options?: CredentialValidationOptions): Promise<UserInfo | null>;
@@ -22,8 +44,8 @@ export declare function isApiKeyToken(token: string): boolean;
 export declare function isApiKeyIdentity(identity: AuthIdentity): identity is ApiKeyIdentity;
 export declare function validateCredential(token: string, env?: EnvironmentConfig, options?: CredentialValidationOptions): Promise<AuthIdentity | null>;
 export declare function openOAuthLogin(authUrl: string, spinner: SpinnerController, opener?: (url: string) => Promise<void>): Promise<boolean>;
-export declare function login(method?: AuthMethod, env?: EnvironmentConfig): Promise<AuthIdentity | null>;
-export declare function ensureAuthenticated(env?: EnvironmentConfig): Promise<AuthIdentity | null>;
+export declare function login(method?: AuthMethod, env?: EnvironmentConfig, projectDir?: string): Promise<AuthIdentity | null>;
+export declare function ensureAuthenticated(env?: EnvironmentConfig, projectDir?: string): Promise<AuthIdentity | null>;
 export declare function logout(env?: EnvironmentConfig): Promise<void>;
 export declare function whoami(env?: EnvironmentConfig): Promise<AuthIdentity | null>;
 export { deleteToken, hasToken, readToken, saveToken };

package/esm/cli/auth/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/login.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,iBAAiB,EAAwB,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,WAAW,EAAoB,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAKjG,OAAO,EAAiB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAW1E,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;AAErE,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,IAAI,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,cAAc,CAAC;AAErD,MAAM,WAAW,2BAA2B;IAC1C,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAaD,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,EAC3C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,iBAA0C,GAC9C,MAAM,CAQR;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,iBAA0C,EAC/C,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqB1B;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,GAAG,QAAQ,IAAI,cAAc,CAEnF;AAyBD,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,iBAA0C,EAC/C,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAU9B;AAgCD,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,iBAAiB,EAC1B,MAAM,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAe,GACnD,OAAO,CAAC,OAAO,CAAC,CAalB;AAwED,wBAAsB,KAAK,CACzB,MAAM,CAAC,EAAE,UAAU,EACnB,GAAG,GAAE,iBAA0C,GAC9C,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA2E9B;AAED,wBAAsB,mBAAmB,CACvC,GAAG,GAAE,iBAA0C,GAC9C,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA6B9B;AAED,wBAAsB,MAAM,CAAC,GAAG,GAAE,iBAA0C,GAAG,OAAO,CAAC,IAAI,CAAC,CAI3F;AAyCD,wBAAsB,MAAM,CAC1B,GAAG,GAAE,iBAA0C,GAC9C,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAiC9B;AAED,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/login.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,iBAAiB,EAAwB,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,WAAW,EAAoB,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAKjG,OAAO,EAAiB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAoB1E;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,SAAQ,GAAG,MAAM,CAgBtF;AAWD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;AAErE,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,IAAI,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,cAAc,CAAC;AAErD,MAAM,WAAW,2BAA2B;IAC1C,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,sCAAsC,CAAC,EAAE,OAAO,CAAC;IACjD,gFAAgF;IAChF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA4GD,iFAAiF;AACjF,wBAAgB,mCAAmC,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAErE;AAyBD,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,EAC3C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,iBAA0C,GAC9C,MAAM,CAQR;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,iBAA0C,EAC/C,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA6D1B;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,GAAG,QAAQ,IAAI,cAAc,CAEnF;AA+CD,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,iBAA0C,EAC/C,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAU9B;AAgCD,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,iBAAiB,EAC1B,MAAM,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAe,GACnD,OAAO,CAAC,OAAO,CAAC,CAalB;AAwRD,wBAAsB,KAAK,CACzB,MAAM,CAAC,EAAE,UAAU,EACnB,GAAG,GAAE,iBAA0C,EAC/C,UAAU,GAAE,MAAc,GACzB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA+F9B;AAED,wBAAsB,mBAAmB,CACvC,GAAG,GAAE,iBAA0C,EAC/C,UAAU,GAAE,MAAc,GACzB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAgD9B;AAID,wBAAsB,MAAM,CAAC,GAAG,GAAE,iBAA0C,GAAG,OAAO,CAAC,IAAI,CAAC,CAI3F;AA2DD,wBAAsB,MAAM,CAC1B,GAAG,GAAE,iBAA0C,GAC9C,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAkC9B;AAED,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC"}

package/esm/cli/auth/login.js

@@ -9,8 +9,141 @@ import { brand, dim, error, warning } from "../ui/colors.js";
 import { createSpinner } from "../ui/progress.js";
 import { PromptInterruptedError, select } from "../utils/terminal-select.js";
 import { API_KEYS_URL, DEFAULT_CALLBACK_PORT, DEFAULT_LOGIN_TIMEOUT_MS, getApiUrl, } from "../shared/constants.js";
-import { createSuccessEnvelope, isJsonMode, outputJson } from "../shared/json-output.js";
+import { resolveApiCredentialCandidatesForAuth } from "../shared/config.js";
+import { createErrorEnvelope, createSuccessEnvelope, isJsonMode, outputJson, } from "../shared/json-output.js";
 import { isInteractive } from "../shared/interactive.js";
+import { getEnvSource } from "../../src/utils/env-loader.js";
+import { basename, isAbsolute, relative } from "../../src/platform/compat/path/index.js";
+import { cwd, getEnv } from "../../src/platform/index.js";
+/**
+ * Describe where an API-token credential actually came from.
+ *
+ * `.env` files in the working directory are loaded into the environment, so a
+ * token can arrive under `VERYFRONT_API_TOKEN` while that variable is unset in
+ * the developer's shell. Reporting only the variable name sends them to check
+ * something they can see is empty; naming the file ends the search. Identity is
+ * directory-dependent for every command that infers a project from config, so
+ * this is worth the extra clause.
+ */
+export function formatEnvSourcePathForDisplay(file, currentCwd = cwd()) {
+    // Repo-relative only: AGENTS.md forbids local absolute paths in user-facing
+    // output. A file outside the working directory, including a Windows
+    // cross-drive result, degrades to its name rather than exposing the layout.
+    // A bare filename stays bare (`.env`); anything nested is prefixed so it
+    // reads unambiguously as a path (`./config/.env`). The test is for a
+    // separator rather than a leading ".", because a dot-*directory* also starts
+    // with one, so `.config/.env` would otherwise be the only nested path printed
+    // without the prefix.
+    const rel = relative(currentCwd, file);
+    const shown = rel === "." || rel.startsWith("..") || isAbsolute(rel)
+        ? basename(file)
+        : /[/\\]/.test(rel) && !rel.startsWith("./")
+            ? `./${rel}`
+            : rel;
+    return shown;
+}
+function describeApiTokenSource(token) {
+    const origin = getEnvSource("VERYFRONT_API_TOKEN");
+    if (origin.source !== "env-file" || getEnv("VERYFRONT_API_TOKEN") !== token) {
+        return "(via VERYFRONT_API_TOKEN)";
+    }
+    return `(via VERYFRONT_API_TOKEN from ${formatEnvSourcePathForDisplay(origin.file)})`;
+}
+/**
+ * How long the bare-`login` preflight will wait on a credential check.
+ *
+ * That check is best-effort: it exists only to say "already logged in" instead
+ * of prompting. A connection the API accepts but never answers would otherwise
+ * block sign-in forever, so the check is bounded and a timeout simply falls
+ * through to the normal flow.
+ */
+const DEFAULT_EXISTING_SESSION_TIMEOUT_MS = 5_000;
+let existingSessionTimeoutMs = DEFAULT_EXISTING_SESSION_TIMEOUT_MS;
+function loginIdentityData(identity, source) {
+    const displayedSource = source === "env-file" ? "env" : source;
+    if (isApiKeyIdentity(identity)) {
+        return {
+            authenticated: true,
+            credential_type: "api_key",
+            source: displayedSource,
+        };
+    }
+    return { ...identity, source: displayedSource };
+}
+async function outputLoginAuthenticationRequiredJson() {
+    await outputJson(createErrorEnvelope("login", {
+        code: "AUTHENTICATION_ERROR",
+        slug: "authentication-required",
+        registrySlug: "authentication-required",
+        message: "Not logged in. Set VERYFRONT_API_TOKEN or run in interactive mode.",
+    }));
+}
+class CredentialValidationUnavailableError extends Error {
+    kind;
+    status;
+    name = "CredentialValidationUnavailableError";
+    constructor(kind, status) {
+        super("Could not validate existing login credentials");
+        this.kind = kind;
+        this.status = status;
+    }
+}
+function isCredentialTimeoutFailure(error) {
+    return error instanceof DOMException &&
+        (error.name === "AbortError" || error.name === "TimeoutError");
+}
+function isCredentialRejectionStatus(status) {
+    return status === 401 || status === 403;
+}
+function isUserInfo(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    const candidate = value;
+    return typeof candidate.id === "string" && candidate.id.trim() !== "" &&
+        typeof candidate.email === "string" && candidate.email.trim() !== "";
+}
+async function outputLoginExplicitMethodJson() {
+    await outputJson(createErrorEnvelope("login", {
+        code: "USAGE_ERROR",
+        slug: "invalid-arguments",
+        registrySlug: "invalid-argument",
+        message: "Explicit login methods are not supported with --json.",
+    }));
+}
+async function outputLoginValidationUnavailableJson(failure) {
+    if (failure.kind === "timeout") {
+        await outputJson(createErrorEnvelope("login", {
+            code: "TIMEOUT_ERROR",
+            slug: "timeout-error",
+            registrySlug: "timeout-error",
+            message: "Timed out while checking existing login credentials. Try again.",
+        }));
+        return;
+    }
+    if (failure.kind === "network") {
+        await outputJson(createErrorEnvelope("login", {
+            code: "NETWORK_ERROR",
+            slug: "network-error",
+            registrySlug: "network-error",
+            message: "Could not reach the Veryfront API while checking existing login credentials.",
+        }));
+        return;
+    }
+    await outputJson(createErrorEnvelope("login", {
+        code: "API_CLIENT_ERROR",
+        slug: "api-client-error",
+        registrySlug: "api-client-error",
+        message: "Veryfront API could not validate existing login credentials.",
+        context: failure.status ? { status: failure.status } : undefined,
+    }));
+}
+/** Test seam: shrink the preflight deadline so a stall is observable quickly. */
+export function __setExistingSessionTimeoutForTests(ms) {
+    existingSessionTimeoutMs = ms ?? DEFAULT_EXISTING_SESSION_TIMEOUT_MS;
+}
+function requestSignal(options) {
+    return options.signal ?? (options.timeoutMs ? AbortSignal.timeout(options.timeoutMs) : undefined);
+}
 const AUTH_OPTIONS = [
     { id: "google", label: "Google" },
     { id: "github", label: "GitHub" },
@@ -20,6 +153,12 @@ const AUTH_OPTIONS = [
 class NetworkError extends Error {
     name = "NetworkError";
 }
+function isCredentialNetworkFailure(error) {
+    return error instanceof TypeError || isCredentialTimeoutFailure(error);
+}
+function throwNetworkError() {
+    throw new NetworkError("Could not reach the Veryfront API");
+}
 export function createOAuthState() {
     const bytes = new Uint8Array(32);
     dntShim.crypto.getRandomValues(bytes);
@@ -39,18 +178,61 @@ export async function validateToken(token, env = getEnvironmentConfig(), options
     try {
         const response = await fetch(`${getApiUrl(env).replace(/\/$/, "")}/me`, {
             headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+            signal: requestSignal(options),
         });
         if (!response.ok) {
             // Consume response body to prevent resource leak
             await response.body?.cancel();
+            if (options.throwOnCredentialValidationUnavailable &&
+                !isCredentialRejectionStatus(response.status)) {
+                throw new CredentialValidationUnavailableError("service", response.status);
+            }
+            if (options.throwOnNetworkError && response.status >= 500)
+                throwNetworkError();
+            return null;
+        }
+        try {
+            const userInfo = await response.json();
+            if (isUserInfo(userInfo))
+                return userInfo;
+            if (options.throwOnCredentialValidationUnavailable) {
+                throw new CredentialValidationUnavailableError("service", response.status);
+            }
             return null;
         }
-        return (await response.json());
+        catch (error) {
+            if (options.throwOnCredentialValidationUnavailable) {
+                if (error instanceof CredentialValidationUnavailableError) {
+                    throw error;
+                }
+                if (isCredentialTimeoutFailure(error)) {
+                    throw new CredentialValidationUnavailableError("timeout");
+                }
+                if (error instanceof TypeError) {
+                    throw new CredentialValidationUnavailableError("network");
+                }
+                throw new CredentialValidationUnavailableError("service", response.status);
+            }
+            throw error;
+        }
     }
     catch (e) {
-        if (options.throwOnNetworkError && e instanceof TypeError) {
-            throw new NetworkError("Could not reach the Veryfront API");
+        if (options.throwOnCredentialValidationUnavailable) {
+            if (e instanceof CredentialValidationUnavailableError) {
+                throw e;
+            }
+            if (isCredentialTimeoutFailure(e)) {
+                throw new CredentialValidationUnavailableError("timeout");
+            }
+            if (e instanceof TypeError) {
+                throw new CredentialValidationUnavailableError("network");
+            }
+            throw e;
         }
+        if (e instanceof NetworkError)
+            throw e;
+        if (options.throwOnNetworkError && isCredentialNetworkFailure(e))
+            throwNetworkError();
         return null;
     }
 }
@@ -68,14 +250,37 @@ async function validateApiKey(token, env = getEnvironmentConfig(), options = {})
         url.searchParams.set("limit", "1");
         const response = await fetch(url, {
             headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+            signal: requestSignal(options),
         });
         await response.body?.cancel();
-        return response.ok;
+        if (!response.ok) {
+            if (options.throwOnCredentialValidationUnavailable &&
+                !isCredentialRejectionStatus(response.status)) {
+                throw new CredentialValidationUnavailableError("service", response.status);
+            }
+            if (options.throwOnNetworkError && response.status >= 500)
+                throwNetworkError();
+            return false;
+        }
+        return true;
     }
     catch (e) {
-        if (options.throwOnNetworkError && e instanceof TypeError) {
-            throw new NetworkError("Could not reach the Veryfront API");
+        if (options.throwOnCredentialValidationUnavailable) {
+            if (e instanceof CredentialValidationUnavailableError) {
+                throw e;
+            }
+            if (isCredentialTimeoutFailure(e)) {
+                throw new CredentialValidationUnavailableError("timeout");
+            }
+            if (e instanceof TypeError) {
+                throw new CredentialValidationUnavailableError("network");
+            }
+            throw e;
         }
+        if (e instanceof NetworkError)
+            throw e;
+        if (options.throwOnNetworkError && isCredentialNetworkFailure(e))
+            throwNetworkError();
         return false;
     }
 }
@@ -186,7 +391,178 @@ async function loginWithToken() {
     }
     return token;
 }
-export async function login(method, env = getEnvironmentConfig()) {
+function writeConfigFileSwitchingGuidance() {
+    console.log("  " +
+        dim("Remove or replace apiToken in veryfront.json before signing in with another method."));
+}
+function writeEnvironmentConfigFileSwitchingGuidance() {
+    console.log("  " +
+        dim("Remove or replace apiToken in veryfront.json after unsetting VERYFRONT_API_TOKEN."));
+}
+function writeAuthoritativeCredentialRejectedMessage(source, hasConfigToken) {
+    console.log();
+    if (source === "environment") {
+        console.log("  " + error("✗") + " VERYFRONT_API_TOKEN was rejected by the Veryfront API.");
+        console.log("  " +
+            dim("Unset VERYFRONT_API_TOKEN or replace the variable before signing in with another method."));
+        if (hasConfigToken)
+            writeEnvironmentConfigFileSwitchingGuidance();
+        return;
+    }
+    console.log("  " + error("✗") + " apiToken from veryfront.json was rejected by the Veryfront API.");
+    writeConfigFileSwitchingGuidance();
+}
+function credentialSourceForDisplay(source) {
+    return source === "environment" ? "VERYFRONT_API_TOKEN" : "apiToken from veryfront.json";
+}
+function writeAuthoritativeCredentialUnavailableMessage(source, failure, hasConfigToken) {
+    const credential = credentialSourceForDisplay(source);
+    console.log();
+    if (failure.kind === "timeout") {
+        console.log("  " + error("✗") + ` Timed out while checking ${credential} with the Veryfront API.`);
+    }
+    else if (failure.kind === "network") {
+        console.log("  " + error("✗") + ` Could not reach the Veryfront API while checking ${credential}.`);
+    }
+    else {
+        const status = failure.status ? ` (${failure.status})` : "";
+        console.log("  " + error("✗") + ` Veryfront API could not validate ${credential}${status}.`);
+    }
+    console.log("  " + dim("Try again before signing in with another method."));
+    if (source === "environment") {
+        console.log("  " + dim("Unset VERYFRONT_API_TOKEN before signing in with another method."));
+        if (hasConfigToken)
+            writeEnvironmentConfigFileSwitchingGuidance();
+        return;
+    }
+    writeConfigFileSwitchingGuidance();
+}
+/**
+ * Report an already-valid session, or null when there is nothing usable.
+ *
+ * Returns a sentinel when JSON or human output already explained why login
+ * must stop instead of falling through to lower-priority credentials or a new
+ * login that later commands will not use.
+ */
+async function describeExistingSession(env, projectDir = cwd()) {
+    const candidates = await resolveApiCredentialCandidatesForAuth(env, projectDir);
+    if (candidates.length === 0)
+        return null;
+    const hasConfigToken = candidates.some((candidate) => candidate.apiTokenSource === "config-file");
+    let hasStoredToken = candidates.some((candidate) => candidate.apiTokenSource === "token-store");
+    const signal = AbortSignal.timeout(existingSessionTimeoutMs);
+    let unavailable = null;
+    for (const { apiToken, apiTokenSource, authoritative, validationEnv } of candidates) {
+        const source = apiTokenSource === "config-file"
+            ? "config-file"
+            : apiTokenSource === "token-store"
+                ? "stored"
+                : "environment";
+        let identity;
+        try {
+            // Bounded: this preflight only decides whether to say "already logged in"
+            // instead of prompting. An authoritative credential that cannot be
+            // checked must still stop, because later commands will resolve it ahead
+            // of any replacement login.
+            identity = await validateCredential(apiToken, validationEnv, {
+                signal,
+                throwOnCredentialValidationUnavailable: true,
+            });
+        }
+        catch (error) {
+            if (error instanceof CredentialValidationUnavailableError) {
+                unavailable ??= error;
+                if (authoritative || apiTokenSource === "token-store") {
+                    if (!isJsonMode() && source !== "stored") {
+                        writeAuthoritativeCredentialUnavailableMessage(source, error, hasConfigToken);
+                        return "failure-output";
+                    }
+                    break;
+                }
+                continue;
+            }
+            throw error;
+        }
+        if (!identity) {
+            if (apiTokenSource === "token-store") {
+                await deleteToken(env);
+                hasStoredToken = false;
+            }
+            if (authoritative) {
+                if (!isJsonMode()) {
+                    if (source !== "stored") {
+                        writeAuthoritativeCredentialRejectedMessage(source, hasConfigToken);
+                        return "failure-output";
+                    }
+                }
+                break;
+            }
+            continue;
+        }
+        if (isJsonMode()) {
+            await outputJson(createSuccessEnvelope("login", loginIdentityData(identity, apiTokenSource)));
+            return identity;
+        }
+        console.log();
+        console.log("  ✓ " +
+            (isApiKeyIdentity(identity)
+                ? "Already authenticated with an API key"
+                : "Already logged in as " + brand(identity.email)));
+        // An environment credential is a valid session for every command, but this
+        // path stores nothing, and `login` implies it did. The variable is often set
+        // by a `.env` in the working directory the developer has forgotten about,
+        // the case `whoami` now names, so the session ends at the directory
+        // boundary. Say so rather than let them discover it elsewhere.
+        if (source === "environment") {
+            if (hasStoredToken) {
+                console.log("  " + dim("Using VERYFRONT_API_TOKEN; it takes precedence over a stored credential."));
+                console.log("  " +
+                    dim("Unset VERYFRONT_API_TOKEN before attempting to use the stored credential, or replace the variable to switch tokens."));
+            }
+            else {
+                console.log("  " + dim("Using VERYFRONT_API_TOKEN; no stored login was created."));
+                console.log("  " +
+                    dim("Unset VERYFRONT_API_TOKEN before using another login method, or replace the variable to switch tokens."));
+            }
+            if (hasConfigToken)
+                writeEnvironmentConfigFileSwitchingGuidance();
+        }
+        else if (source === "config-file") {
+            console.log("  " +
+                dim("Using apiToken from veryfront.json; it takes precedence over stored credentials."));
+            writeConfigFileSwitchingGuidance();
+        }
+        console.log("  " +
+            dim("Run 'veryfront login --token' (or --google, --github, --microsoft) to sign in again."));
+        return identity;
+    }
+    if (isJsonMode() && unavailable) {
+        await outputLoginValidationUnavailableJson(unavailable);
+        return "failure-output";
+    }
+    return null;
+}
+export async function login(method, env = getEnvironmentConfig(), projectDir = cwd()) {
+    if (isJsonMode() && method !== undefined) {
+        await outputLoginExplicitMethodJson();
+        return null;
+    }
+    // A bare `veryfront login` is the documented first step of the deploy
+    // journey, and an already-authenticated developer ran it only to be asked for
+    // a token they do not need. Report the session instead. An explicit method is
+    // intent to sign in again, so account switching still works — and a session
+    // that no longer validates falls through to the normal flow.
+    if (method === undefined) {
+        const existing = await describeExistingSession(env, projectDir);
+        if (existing === "failure-output")
+            return null;
+        if (existing)
+            return existing;
+        if (isJsonMode()) {
+            await outputLoginAuthenticationRequiredJson();
+            return null;
+        }
+    }
     if (!isInteractive() && (method === undefined || method === "token")) {
         cliLogger.error("Not logged in. Set VERYFRONT_API_TOKEN or run in interactive mode.");
         return null;
@@ -252,24 +628,38 @@ export async function login(method, env = getEnvironmentConfig()) {
         : "  ✓ Logged in as " + brand(identity.email));
     return identity;
 }
-export async function ensureAuthenticated(env = getEnvironmentConfig()) {
+export async function ensureAuthenticated(env = getEnvironmentConfig(), projectDir = cwd()) {
     const humanOutput = !isJsonMode();
-    if (env.apiToken) {
-        const credential = await validateCredential(env.apiToken, env);
+    const candidates = await resolveApiCredentialCandidatesForAuth(env, projectDir);
+    for (const candidate of candidates) {
+        let credential;
+        try {
+            credential = await validateCredential(candidate.apiToken, candidate.validationEnv, candidate.apiTokenSource === "token-store"
+                ? { throwOnCredentialValidationUnavailable: true }
+                : undefined);
+        }
+        catch (error) {
+            if (candidate.apiTokenSource === "token-store" &&
+                error instanceof CredentialValidationUnavailableError) {
+                return null;
+            }
+            throw error;
+        }
         if (credential)
             return credential;
-        if (humanOutput) {
+        if (candidate.apiTokenSource === "env" && humanOutput) {
             console.log("  " + warning("Warning: VERYFRONT_API_TOKEN is invalid"));
         }
-    }
-    const storedToken = await readToken(env);
-    if (storedToken) {
-        const credential = await validateCredential(storedToken, env);
-        if (credential)
-            return credential;
-        await deleteToken(env);
-        if (humanOutput) {
-            console.log("  " + warning("Session expired. Please log in again."));
+        if (candidate.apiTokenSource === "config-file" && humanOutput) {
+            console.log("  " + warning("Warning: apiToken from veryfront.json is invalid"));
+        }
+        if (candidate.authoritative)
+            return null;
+        if (candidate.apiTokenSource === "token-store") {
+            await deleteToken(env);
+            if (humanOutput) {
+                console.log("  " + warning("Session expired. Please log in again."));
+            }
         }
     }
     if (!humanOutput)
@@ -278,21 +668,37 @@ export async function ensureAuthenticated(env = getEnvironmentConfig()) {
         cliLogger.error("Not logged in. Set VERYFRONT_API_TOKEN or run in interactive mode.");
         return null;
     }
-    return login(undefined, env);
+    return login(undefined, env, projectDir);
 }
+const CREDENTIAL_VALIDATION_UNAVAILABLE = Symbol("credential-validation-unavailable");
 export async function logout(env = getEnvironmentConfig()) {
     await deleteToken(env);
     console.log();
     console.log("  ✓ Logged out");
 }
 async function reportCredential(token, source, env) {
-    const credential = await validateCredential(token, env);
-    if (!credential)
+    let credential;
+    try {
+        credential = await validateCredential(token, env, {
+            throwOnCredentialValidationUnavailable: true,
+        });
+    }
+    catch (error) {
+        if (error instanceof CredentialValidationUnavailableError) {
+            return CREDENTIAL_VALIDATION_UNAVAILABLE;
+        }
+        throw error;
+    }
+    if (!credential) {
+        if (source === "token-store")
+            await deleteToken(env);
         return null;
+    }
+    const displayedSource = source === "env-file" ? "env" : source;
     if (!isApiKeyIdentity(credential)) {
         const userInfo = credential;
         if (isJsonMode()) {
-            await outputJson(createSuccessEnvelope("whoami", { ...userInfo, source }));
+            await outputJson(createSuccessEnvelope("whoami", { ...userInfo, source: displayedSource }));
             return userInfo;
         }
         console.log();
@@ -303,27 +709,30 @@ async function reportCredential(token, source, env) {
             await outputJson(createSuccessEnvelope("whoami", {
                 authenticated: true,
                 credential_type: "api_key",
-                source,
+                source: displayedSource,
             }));
             return { authenticated: true, type: "apiKey" };
         }
         console.log();
         console.log("  ✓ Authenticated with an API key");
     }
-    console.log("  " + dim(source === "env" ? "(via VERYFRONT_API_TOKEN)" : `Token stored at: ${getTokenLocation(env)}`));
+    console.log("  " + dim(source === "env" || source === "env-file"
+        ? describeApiTokenSource(token)
+        : source === "config-file"
+            ? "apiToken from veryfront.json"
+            : `Token stored at: ${getTokenLocation(env)}`));
     return credential;
 }
 export async function whoami(env = getEnvironmentConfig()) {
-    if (env.apiToken) {
-        const result = await reportCredential(env.apiToken, "env", env);
-        if (result)
-            return result;
-    }
-    const storedToken = await readToken(env);
-    if (storedToken) {
-        const result = await reportCredential(storedToken, "token-store", env);
+    const candidates = await resolveApiCredentialCandidatesForAuth(env);
+    for (const candidate of candidates) {
+        const result = await reportCredential(candidate.apiToken, candidate.apiTokenSource, candidate.validationEnv);
+        if (result === CREDENTIAL_VALIDATION_UNAVAILABLE)
+            break;
         if (result)
             return result;
+        if (candidate.authoritative)
+            break;
     }
     if (isJsonMode()) {
         await outputJson(createSuccessEnvelope("whoami", { authenticated: false }));

package/esm/cli/commands/build/error-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/build/error-handler.ts"],"names":[],"mappings":"AAIA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAgBtD"}
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/build/error-handler.ts"],"names":[],"mappings":"AAqCA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAyBtD"}